Guidance · Reviewed August 2026
Who needs one, the three parts it must contain, what goes in each, and the mistakes that make a policy worthless when an inspector or a client asks to see it.
The short answer
Every business must have a policy for managing health and safety. If you employ five or more people, it must be written down — that is section 2(3) of the Health and Safety at Work Act 1974 (HASAWA), not best practice. HSE expects it to cover three things: your statement of intent, who is responsible for what, and the practical arrangements you have in place.
Do You Actually Need One?
Yes — every business does. What changes at five employees is whether it has to be written down, and that distinction trips people up constantly.
| Employees | What the law requires |
|---|---|
| Fewer than five | You must have a policy for managing health and safety. You do not have to write it down — though it is useful to, and most clients will ask for it anyway. |
| Five or more | The policy must be written down, and you must share it — and any changes to it — with your employees. |
Counting to five
The Act says “five or more employees” — not more than five, which a surprising number of websites get wrong. At exactly five, the written policy is required.
The wording sets no qualification by hours, so it is a headcount rather than full-time equivalents. Part-time, fixed-term and seasonal staff each count as one. If you regularly or predictably reach five, write the policy before you get there.
If you use casual help — including family members — check whether they count as employees. Where you control how the work is done, they may be employees for health and safety purposes whatever their tax status.
The Three Parts a Policy Must Cover
HSE sets out a three-part structure. A document that only contains the first part — a page of commitments and no detail — is the single most common failing, and it is what an inspector or a client will spot first.
PART 1
Statement of intent
Your general approach to health and safety — your commitment to managing it, and your aims. The employer or most senior person in the business signs and dates it, and reviews it regularly.
PART 2
Responsibilities
The names, positions and roles of the people who hold specific health and safety responsibilities. Names, not job titles alone — “the management team” is not an answer.
PART 3
Arrangements
The practical detail — how you actually achieve the aims in Part 1. Risk assessments, training, equipment, emergency procedures. This is the longest part and the one that gets skipped.
HSE publishes a worked example and a blank template on its website. They are free, and there is no reason to buy a generic policy from anyone.
What Goes in the Arrangements Section
This is where a policy either describes your business or reads like it was downloaded. Cover the things that actually apply to your work — and be specific about who, when and how.
📋
Risk assessment
How you identify hazards, who carries assessments out, and how often they are reviewed. See risk assessment guidance.
🎓
Training and competence
What training each role requires, how induction works, and how you track expiry. See health and safety courses.
🔥
Emergency procedures
Evacuation routes, assembly points, who takes the roll call, and where firefighting equipment sits. See fire safety guidance.
⛑️
First aid
Who your first aiders or appointed persons are, where the kit is kept, and what your needs assessment concluded. See first aid guidance.
📓
Accidents and reporting
Where the accident book lives, who investigates, and what triggers a RIDDOR report. See incidents and reporting.
🦺
PPE and equipment
What is issued, to whom, who maintains it and who replaces it. Remember you cannot charge for it. See PPE guidance.
⚙️
Safe systems of work
Method statements, permits to work, and how tasks with residual risk are controlled. See safe systems of work.
🗣️
Consultation
How employees raise concerns, who they raise them with, and how safety representatives are involved.
Add whatever else your work involves — hazardous substances, work at height, manual handling, lone working, home working. Leave out what doesn’t apply. A policy that lists arrangements for hazards you don’t have is a policy nobody wrote for you.
Where Policies Go Wrong
Most policies that fail an inspection or a client audit fail for the same handful of reasons.
| The problem | Why it matters |
|---|---|
| Statement of intent only | A page of commitments with no responsibilities and no arrangements is not a policy. It is the most common defect by a wide margin. |
| Downloaded and not adapted | Generic templates describe hazards you don’t have and miss the ones you do. Inspectors recognise them instantly. |
| Unsigned or undated | The statement of intent should be signed by the most senior person and dated. Without that, nobody owns it. |
| Names that have left | Part 2 names individuals. When they leave, the policy is out of date immediately — and it shows a document nobody reads. |
| Confused with risk assessments | They are separate documents. The policy sets the framework; assessments record specific hazards and controls. You need both. |
| Never shared | You must bring the policy, and changes to it, to employees’ attention. A file on a shared drive nobody has been told about doesn’t do that. |
| Inaccessible | If staff have visual impairments or don’t read English well, an alternative format or translation may be needed for the policy to do its job. |
Reviewing and Updating It
There is no fixed review interval in law, but annually is the working standard, and you should review sooner whenever something changes. Practical triggers:
- You cross the five-employee threshold
- Someone named in Part 2 changes role or leaves
- New equipment, premises, processes or substances
- An accident, a near miss, or an enforcement notice
- A change in the law that affects your arrangements
- A client audit or accreditation assessment flags a gap
Date each revision. A policy reviewed last month carries far more weight with an inspector than one signed in 2019, whatever the content.
Working out what your arrangements need to cover
Map training requirements by sector, hazard and job role, and see when each certificate expires. Free, no account needed — the tools sit on envicourse.com, our course marketplace, and open in a new tab.
Training That Covers Policy Writing
Writing the policy is usually the job of whoever holds the competent person role. These are the routes that cover it.
| If you need to… | Usual route |
|---|---|
| Manage safety for a small team | IOSH Managing Safely — three days, covering risk assessment and the legal framework. |
| Hold a formal H&S role | NEBOSH General Certificate — the standard qualification for anyone writing policy for a whole organisation. |
| Carry out the assessments behind it | Risk assessment training. |
| Move into the role properly | Health and safety officer courses, or occupational health and safety training. |
If you would rather have the gaps identified for you first, a health and safety risk review will show what your arrangements are missing before you write them up.
Frequently Asked Questions
Is a written health and safety policy a legal requirement?
If you employ five or more people, yes — section 2(3) of HASAWA requires it in writing and requires you to bring it to employees’ attention. Below five you still need a policy for managing health and safety; you just don’t have to write it down.
What are the three parts of a health and safety policy?
A statement of intent setting out your general approach and aims, signed by the most senior person; responsibilities, naming the people who hold specific health and safety duties; and arrangements, describing the practical measures you have in place to achieve the aims.
Can I just use a template?
As a starting structure, yes — HSE publishes a free example and template. But a policy has to describe your business. The parts that matter are the responsibilities and arrangements, and nobody can write those for you. A template completed without adaptation is one of the first things an inspector or client auditor will notice.
What’s the difference between a policy and a risk assessment?
The policy is the framework: who manages health and safety, and how. A risk assessment records specific hazards, who might be harmed and what controls are in place for a particular activity. They are different documents with different legal bases — the policy from HASAWA section 2(3), the assessment from the Management of Health and Safety at Work Regulations 1999. You need both.
Do part-time staff count towards the five?
Yes. The Act refers to “five or more employees” without qualifying by hours, so it is a headcount rather than full-time equivalents — part-time, fixed-term and seasonal employees each count as one. Note also that the threshold is five or more, not more than five: at exactly five employees the written policy is required.
How often should it be reviewed?
There is no interval fixed in law. Annually is the working standard, plus a review whenever something material changes — new premises, equipment or processes, a change of responsible person, an accident or enforcement notice, or a change in the law. Date every revision.
Who should sign it?
The employer, or the most senior person in the business — a director or owner rather than a safety manager. The point of the signature is to show that responsibility sits at the top, which is also where personal liability sits under section 37 of the Act.
Related Guidance
Risk assessment →
Employer duties checklist →
Managing health and safety →
What is health and safety? →
All guidance topics →
General guidance only, reviewed against HSE guidance and the Health and Safety at Work etc. Act 1974 in August 2026. Envico is an independent training intermediary and is not affiliated with the HSE.